Week 8, 2026

16–22 February 2026

New CVEs: 1,331
Critical: 121
High: 505
Newly exploited: 8
Advisories: 374
Malicious pkgs: 79

Newly exploited 8

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.9
CVE-2025-49113 KEV Feb 20, 2026 Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization
Roundcube · Webmail

EPSS 99%
High 7.2
CVE-2025-68461 KEV Feb 20, 2026 Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
Roundcube · Webmail

EPSS 27%
Critical 10.0
CVE-2026-22769 KEV Feb 18, 2026 Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthen…
Dell · RecoverPoint for Virtual Machines

EPSS 14%
Medium 6.8
CVE-2021-22175 KEV Feb 18, 2026 When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5…
GitLab · GitLab

EPSS 53%
Critical 9.8
CVE-2020-7796 KEV Feb 17, 2026 Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
EPSS 94%
High 8.8
CVE-2026-2441 KEV Feb 17, 2026 Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch…
Google · Chrome

EPSS 55%
High 8.8
CVE-2008-0015 KEV Feb 17, 2026 Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control i…
EPSS 77%
High 7.2
CVE-2024-7694 KEV Feb 17, 2026 TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload
TeamT5 · ThreatSonar Anti-Ransomware

EPSS 1.8%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.4
CVE-2026-26980 Ghost has a SQL Injection in its Content API
TryGhost · Ghost

EPSS 71%
Critical 9.3
CVE-2026-2329 Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow
Grandstream · GXP1625 · GXP1628 · GXP1615

EPSS 42%
Critical 10.0
CVE-2026-22769 Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthen…
Dell · RecoverPoint for Virtual Machines

EPSS 14%
Critical 9.8
CVE-2019-25441 thesystem 1.0 Command Injection via run_command endpoint
kostasmitroglou · thesystem

EPSS 9.3%
Critical 9.8
CVE-2026-0926 Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]
prodigycommerce · Prodigy Commerce

EPSS 9.3%
Critical 9.3
CVE-2026-26988 LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream
librenms · librenms

EPSS 8.4%
Critical 9.8
CVE-2026-27175 MajorDoMo Command Injection in rc/index.php via Race Condition
sergejey · MajorDoMo

EPSS 6.9%
Critical 9.8
CVE-2026-27174 MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
sergejey · MajorDoMo

EPSS 6.9%
Critical 9.8
CVE-2025-71243 SPIP Saisies Plugin < 5.11.1 Remote Code Execution
SPIP · Saisies pour formulaire

EPSS 5.6%
Critical 9.3
CVE-2026-23491 InvoicePlane has Unauthenticated Path Traversal in Guest Controller
InvoicePlane · InvoicePlane

EPSS 4.6%
Critical 10.0
CVE-2026-26030 Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
Microsoft · semantic-kernel

EPSS 3.9%
Critical 9.8
CVE-2026-1405 Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload
franchidesign · Slider Future

EPSS 3.5%
Critical 9.8
CVE-2026-27476 RustFly 2.0.0 Command Injection via UDP Remote Control
Bixat · RustFly

EPSS 3%
Critical 9.8
CVE-2026-2686 SECCN Dingcheng G10 session_login.cgi qq os command injection
SECCN Dingcheng · G10

EPSS 2.6%
Critical 9.8
CVE-2025-65791 ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. N…
EPSS 1.8%

All 121 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.2
CVE-2026-2041 Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability
Nagios · Host

EPSS 76%
High 7.2
CVE-2026-2043 Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability
Nagios · Host

EPSS 75%
Medium 4.7
CVE-2026-2537 Comfast CF-E4 HTTP POST Request mbox-config command injection
Comfast · CF-E4

EPSS 28%
Medium 6.3
CVE-2026-2823 Comfast CF-E7 webmggnt mbox-config sub_41ACCC command injection
Comfast · CF-E7

EPSS 19%
Medium 6.3
CVE-2026-2824 Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injection
Comfast · CF-E7

EPSS 17%
Medium 6.3
CVE-2026-2535 Comfast CF-N1 V2 mbox-config sub_44AB9C command injection
Comfast · CF-N1 V2

EPSS 16%
Medium 6.3
CVE-2026-2534 Comfast CF-N1 V2 mbox-config sub_44AC4C command injection
Comfast · CF-N1 V2

EPSS 15%
High 7.2
CVE-2026-2670 Advantech WISE-6610-NB Background Management openvpn_apply os command injection
Advantech · WISE-6610-EB · WISE-6610P-DEA · WISE-6610-JB

EPSS 14%

Advisories

USN-8028-7 linux-nvidia-lowlatency vulnerabilities 753 CVEs
USN-8052-1 linux-lowlatency vulnerabilities 753 CVEs
USN-8028-6 linux-hwe-6.8, linux-lowlatency-hwe-6.8 vulnerabilities 753 CVEs
USN-8028-5 linux-aws, linux-aws-6.8, linux-gkeop, linux-nvidia, linux-nvidia-6.8, linux-oracle, linux-oracle-6.8 vulnerabilities 753 CVEs
USN-8028-4 linux-aws-fips, linux-fips vulnerabilities 753 CVEs
USN-8028-3 linux-realtime, linux-raspi-realtime vulnerabilities 753 CVEs
USN-8031-3 linux-gcp, linux-gke vulnerabilities 752 CVEs
USN-8031-2 linux-gcp-fips vulnerabilities 752 CVEs
USN-8029-2 linux-aws, linux-oracle vulnerabilities 367 CVEs
USN-8048-1 linux-oem-6.17 vulnerabilities 366 CVEs